System logs are valuable tools for administrators. Examining system logs may help diagnose the cause of system problems. Manually determining which log entries relate to a given problem, however, is in general a challenging, cumbersome, and error prone endeavor.
It might take many hours to sort through hundreds, thousands, or millions of unique log entries to identify those that pertain to the issue being investigated. Once the relevant messages are identified, it requires expertise on the part of the administrator to effectively parse the logs to understand the cause and effect relationships between the records. The process often requires expertise with tools, such as text file sorting and searching programs and scripts. The process is also prone to error. If the administrator inadvertently discounts a single log entry that represents an important event relating to the problem, the conclusion of the analysis will usually be incorrect or incomplete. Administrators often fail to correlate important events that relate to a problem, leaving the diagnosis of the problem incomplete.
These system log analysis challenges tend to increase as devices become more and more complex. Some complex systems, such as network routing and switching equipment, may log thousands of unique system events. It is nearly impossible for an administrator to fully understand what each log entry indicates and how each event might be linked to one another.